Understanding User Accounts

By Author: Henry Brown
Total Articles: 58
Comment this article

A user account is a record that consists of all the information that defines a user to Microsoft Windows Server 2003. This includes the user name and password required for the user to log on, the groups in which the user account has membership, and the rights and permissions the user has for using the computer and network and accessing their resources. A user account provides a user with the ability to log on to a computer to gain access to resources on that computer or to log on to a domain to gain access to network resources. Each person who regularly uses a computer or the network should have a unique user account.
In Windows Server 2003, authentication for domain users is based on user accounts in Active Directory. Authentication confirms the identity of any user trying to log on to a domain or to access network resources. Windows Server 2003 authentication enables single sign-on to all network resources. With single sign-on, a user can log on to the client computer once, using a single password or smart card, and authenticate to N10-004 in the domain. To provide security ...
... for a network running Windows Server 2003, you must provide access for legitimate users but screen out potential intruders. This means you must set up your security features to authenticate all user access to sys?tem resources. Authentication protects against intruders trying to steal identities or impersonate users.
User Account Types
Windows Server 2003 provides three types of user accounts: local user accounts, domain user accounts, and built-in user accounts. With a local user account, a user logs on to a specific computer to gain access to resources on that computer. With a domain user account, a user can log on to a domain to gain access to network resources. Built-in user accounts are created automatically by Windows Server 2003 for the purpose of performing administrative tasks or to gain access to network resources. This training kit focuses on domain user accounts.
Local User Accounts
Local user accounts allow users to log on to, and gain access to resources on, only the computer where the local user account is created. When you create a local user account, as shown in Figure 7-1, Windows Server 2003 creates the account only in that computer's security database, which is called the local security database. Windows Server 2003 does not replicate local user account information to domain controllers. After a local user account is created, the computer uses its local security database to authenticate the local user account, which allows the user to log on to that computer.
Do not create local user accounts on computers that require access to domain resources, because the free Microsoft practice exam questions does not recognize local user accounts. Therefore, the user is unable to gain access to resources in the domain.
Domain User Accounts
Domain user accounts allow users to log on to a domain and gain access to resources anywhere on the network. The user provides his or her user name and password dur?ing the logon process. By using this information, Windows Server 2003 authenticates the user and then builds an access token that contains information about the user and security settings. The access token identifies the IT certification to computers running Windows Server 2003 and computers running pre-Windows Server 2003 operating systems on which the user tries to gain access to resources. Windows Server 2003 provides the access token for the duration of the logon session.
You create a domain user account in a container or an OU in the copy of the Active Directory database (called the directory) on a domain controller, as shown in Figure 7-2. The domain controller replicates the new user account information to all domain con?trollers in the domain.